CN107819585B - SM9 digital signature collaborative generation method and system - Google Patents

Abstract

The invention relates to a collaborative generation method of SM9 digital signatures, which comprises the following steps: m devices each having an integer secret c_iI is 1, …, m is more than or equal to 2; precomputation of P_A＝[(c₁c₂…c_m)^‑1]d_A，g_c＝g^((c₁c₂…c_m)^‑1)，d_AIs the user's private key, g ═ e (P)₁,P_pub) And ^ represents power operation; when required d_AWhen digitally signing a message M, the device 1 optionally selects the integer r₁Calculate g₁＝g_c^r₁(ii) a Devices i, i ═ 2, …, m, in turn optionally integers r_iCalculate g_i＝(g_i‑1^c_i)(g_c^r_i) (ii) a Means m for calculating H ═ H₂(M||g_mN); device 1 calculates S₁＝[(r₁‑c₁h)]P_A(ii) a The device i, i equals 2, …, m, which in turn calculates S_i＝[c_i]S_i‑1+[r_i]P_A；(h,S_m) I.e. the generated digital signature.

Description

SM9 digital signature collaborative generation method and system

Technical Field

The invention belongs to the technical field of information security, and particularly relates to a collaborative generation method and a collaborative generation system for SM9 digital signatures.

Background

SM9 is an identification cryptographic algorithm issued by the national crypto authority based on bilinear mapping (pairing operation), wherein the bilinear mapping (pairing operation) is:

e：G₁×G₂→G_Tin which G is₁、G₂Is an additive cyclic group, G_TIs a multiplication loop group, G₁、G₂、G_TIs a prime number n (note: in the SM9 specification, G₁、G₂、G_TThe order of (A) is given by the capital letter N, and the present application uses the lower case N), i.e. if P, Q, R are each G₁、G₂In (b), e (P, Q) is G_TAnd:

e(P+R,Q)＝e(P,Q)e(R,Q)，

e(P,Q+R)＝e(P,Q)e(P,R)，

e(aP,bQ)＝e(P,Q)^ab。

the SM 9-based algorithm can realize identification-based digital signature, key exchange and data encryption, but the common secret sharing-based digital signature method is not suitable for the SM9 algorithm. The digital signature based on secret sharing is to divide a user private key or a secret related to the user private key into a plurality of shares (each of which is referred to as a secret share), store the shares in a plurality of devices, and when a message needs to be signed by using the user private key, obtain a final digital signature by performing a cooperative calculation using the secret shares of the devices storing the secret shares.

Disclosure of Invention

The invention aims to provide a collaborative generation method and a collaborative generation system suitable for SM9 digital signatures.

Aiming at the purpose of the invention, the technical scheme provided by the invention comprises an SM9 digital signature collaborative generation method and system.

In the following description of the present invention, if P, Q is addition group G₁、G₂Where P + Q represents the addition of P, Q to the addition group, P-Q represents the inverse of P plus Q (addition inverse), and k]P represents the addition of k P's to the addition group, i.e., P +. + P (k total P) (if k is a negative number, the addition inverse of the result of the | k | P additions);

an ellipsis ". -" represents a plurality of identical (types of) data items or a plurality of identical operations;

if a, b are multiplicative groups G_TWhere ab or a.b represents a, b in the multiplicative group G_TMultiplication of (a, ". may be omitted, as long as it does not produce ambiguity), a^-1Indicates that a is an inverse of a (multiplicative inverse) in a multiplicative group, a^tIndicates t a are in multiplicative group G_TUp-multiplication (t is a negative number, and is the inverse of | t | the multiplication result of a), i.e. exponentiation, a^tIs a ^ t;

if c is an integer, then c^-1Representing the modulo n inverse of integer c (i.e., cc)^-1mod n ═ 1); unless otherwise specified, the integers of the invention are multiplied and inversed with respect to the group G₁、G₂、G_TThe modulo n multiplication inverse of order n;

multiple integer multiplications (including integer-symbol multiplications, constant-integer-symbol multiplications), omitting the multiplication "·" as k, without ambiguity₁·k₂Simplified as k₁k₂3 · c, reduced to 3 c;

mod n denotes the modulo n operation (modulo operation), corresponding to modN in the SM9 specification; also, the operator mod n of the modulo n operation is of lowest priority, e.g., a + b mod n equals (a + b) mod n, a-b mod n equals (a-b) mod n, ab mod n equals (ab) mod n.

The SM9 digital signature collaborative generation method comprises two schemes, which are specifically as follows.

Scheme I,

The scheme I of the SM9 digital signature collaborative generation method relates to m devices, wherein m is more than or equal to 2;

the m devices are respectively numbered from No. 1 to No. m;

m devices respectively store [1, n-1 ]]Integer secret c within interval₁,c₂,…,c_mWhere n is group G in the SM9 cryptographic algorithm₁、G₂、G_TOrder of (is prime), c_iIs a secret held by device number i, i-1, …, m;

pre-calculated in the initialization phase to obtain:

P_A＝[(c₁c₂…c_m)^-1]d_A，

g_c＝g^((c₁c₂…c_m)^-1)，

wherein d is_AIs the identity ID of the user_AThe corresponding SM9 identifies the private key (d)_AIs a group G₁Meta in (b), (c)₁c₂…c_m)^-1Is (c)₁c₂…c_m) Modulo n multiplication inverse (i.e., (c)₁c₂…c_m) mod n, inverse of the modulo n multiplication), g ═ e (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

when it is desired to use the user's SM9 to identify the private key d_AWhen digitally signing a message M, M devices generate digital signatures as follows (the user's SM9 identification private key d needs to be used_AThe body that digitally signs for message M may be a cryptographic application, system or cryptographic module that invokes the M devices, or a cryptographic application, system in one of the M devices):

device No. 1 is in [1, n-1 ]]Randomly selecting an integer r in the interval₁Calculate g₁＝g_c^r₁Or g₁＝g_c^(c₁r₁)；

Device No. 1 will g₁To the next device, device No. 2;

the device No. i receives g_i-1Then i is 2, …, m is [1, n-1 ]]Randomly selecting an integer r in the interval_iCalculate g_i＝(g_i-1^c_i)(g_c^r_i) Or g_i＝(g_i-1(g_c^r_i))^c_i；

If i ═ m, go to calculation h, otherwise, device No. i will calculate g_iTransmitting to the next device, i +1 device, until m device finishes g_mCalculating (1);

(each apparatus calculates g_iThe calculation formulas are independent and not necessarily identical

Device m takes w ═ g_m；

One of the m devices (typically device No. 1 or m):

calculating H as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | w represents that w is converted into a string and then merged with the string of M, and n is group G in SM9 cryptographic algorithm₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not, and if w is equal to g ^ h, re-performing g₁,…,g_mUntil w is not equal to g ^ h;

thereafter, device No. 1 calculates S as follows₁：

If device number 1 has previously calculated g₁The formula adopted is g₁＝g_c^r₁And then:

S₁＝[r₁-c₁h]P_A；

if device number 1 has previously calculated g₁The formula adopted is g₁＝g_c^(c₁r₁) And then:

S₁＝[c₁r₁-c₁h]P_A；

(at this time, r₁And calculating g₁R of (1)₁Same)

Device No. 1 will S₁Sending the data to the next device, namely the No. 2 device;

the device No. i receives S_i-1Then, i is 2, …, m, S is calculated as follows_i：

If the device I calculates g before_iThe formula adopted is g_i＝(g_i-1^c_i)(g_c^r_i) And then:

S_i＝[c_i]S_i-1+[r_i]P_A；

if the device I calculates g before_iThe formula adopted is g_i＝(g_i-1(g_c^r_i))^c_iAnd then:

S_i＝[c_i](S_i-1+[r_i]P_A)；

(at this time, r_iAnd calculating g_iR of (1)_iSame)

If i is m, then S is S_m(h, S) is the generated digital signature for the message M, otherwise, the device No. i sends S_iTransmitting to the next device, i +1 device, until m device finishes S_mAnd (4) calculating.

For the above scheme one, in the initialization phase, m devices obtain the secret c₁,…,c_mAnd calculating to obtain P_A、g_cOne way of (2) is as follows:

knowing d beforehand_AThe device (which may be one of the m devices or one device other than the m devices) is in [1, n-1 ]]Randomly selecting m integers c in interval₁,…,c_mAnd calculating:

P_A＝[(c₁c₂…c_m)^-1]d_A，g_c＝g^((c₁c₂…c_m)^-1) Wherein g ═ e (P)₁,P_pub)；

Then d is_ADestroying P_A、g_c、c_iTo No. i deviceI-1, …, m (including perhaps itself).

For the above scheme one, if d_AIs known in advance by device No. 1, m devices obtain the secret c during the initialization phase₁,…,c_mAnd calculating to obtain P_A、g_cAnother way of doing so is as follows:

device No. 1 is in [1, n-1 ]]Randomly selecting an integer c in the interval₁Or in [1, n-1 ]]Fixedly selecting an integer c unknown to other devices in the interval₁(i.e. for different d)_AFixed selection c₁Value of) calculating Q₁＝[(c₁)^-1]d_A，u₁＝g^((c₁)^-1) Wherein g ═ e (P)₁,P_pub) Then Q is added₁、u₁Sending the data to the next device, namely the No. 2 device;

device i receives Q_i-1、u_i-1Then i is 2, …, m is [1, n-1 ]]Randomly selecting an integer c in the interval_iOr in [1, n-1 ]]Fixedly selecting an integer c unknown to other devices in the interval_i(i.e. for different d)_AFixed selection c_iValue of) calculating Q_i＝[(c_i)^-1]Q_i-1，u_i＝u_i-1^((c_i)^-1)；

If i is m, then P is taken_A＝Q_m，g_c＝u_mOtherwise, the device No. i will send to the next device, i +1, until Q is completed_m、u_mCalculating;

finally, device number m will P_A、g_cTo other m-1 devices, device No. 1 distributes d_AAnd (4) destroying.

In fact, P is calculated_A、g_cThe order of the devices in (1) is not important; if device i knows d beforehand_ASimilar transfer mode calculations may be used.

For the above scheme one, if the user's SM9 identifies the private key d_AWhile for data decryption, e (d) needs to be calculated during data decryption_AV) at whichV is a group G₂E (d) in the following manner_AV) cooperative calculation:

device number 1 calculates v₁＝e(P_A,V)^c₁V is to be₁Sending the data to the next device, namely the No. 2 device;

device number i receives v_i-1Then, i is 2, …, m, calculate v_i＝v_i-1^c_i；

If i is m, then v_mIs e (d)_AV), otherwise, device No. i will V_iAnd sending to the next device, i +1 th device, until i equals m.

Scheme II,

The second scheme of the SM9 digital signature collaborative generation method of the invention also relates to m devices, wherein m is more than or equal to 2;

the m devices are respectively numbered from No. 1 to No. m;

m devices each have [1, n-1 ] stored or derived from the stored secret]Integer secret c within interval₁,c₂,…,c_mWherein n is group G in SM9 cryptographic algorithm₁、G₂、G_TOrder of (is prime), c_iIs a secret held by or derived from device number i, i is 1, …, m, and (c)₁+c₂+…+c_m)mod n≠0；

Pre-calculated in the initialization phase to obtain:

P_A＝[(c₁+c₂+…+c_m)^-1]d_A，

g_c＝g^((c₁+c₂+…+c_m)^-1)，

wherein d is_AIs the identity ID of the user_AThe corresponding SM9 identifies the private key (d)_AIs a group G₁Meta in (b), (c)₁+c₂+…+c_m)^-1Is (c)₁+c₂+…+c_m) Modulo n multiplication inverse (i.e., (c)₁+c₂+…+c_m) mod n, inverse of the modulo n multiplication), g ═ e (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is the master private or master key, see SM9 specification);

when it is desired to use the user's SM9 to identify the private key d_AWhen digitally signing a message M, M devices generate digital signatures as follows (the user's SM9 identification private key d needs to be used_AThe body that digitally signs for message M may be a cryptographic application, system or cryptographic module that invokes the M devices, or a cryptographic application, system in one of the M devices):

device number i in [1, n-1 ]]Randomly selecting an integer r in the interval_iCalculate g_i＝g_c^r_i，i＝1,…,m；

One (any of) m devices:

calculating w ═ g₁g₂…g_m，h＝H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | w represents that w is converted into a string and then merged with the string of M, and n is group G in SM9 cryptographic algorithm₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not, and if w is equal to g ^ h, re-performing g₁,…,g_mUntil w is not equal to g ^ h;

thereafter, the i-th device calculates S_i＝[(r_i-c_ih)]P_A，i＝1,…,m；

(at this time, r_iAnd calculating g_iR of (1)_iSame)

Then, one of the m devices calculates S ═ S₁+S₂+…+S_m；

Then (h, S) is the generated digital signature for message M.

For scheme two above, in the initialization phase, m devices obtain the secret c₁,…,c_mAnd calculating to obtain P_A、g_cOne way of (2) is as follows:

knowing d beforehand_ACan be m pieces of clothesOne device in or out of m devices) is in [1, n-1 ]]Randomly selecting m integers c in interval₁,…,c_mAnd so that (c)₁+c₂+…+c_m) mod n ≠ 0, calculates:

P_A＝[(c₁+c₂+…+c_m)^-1]d_A，g_c＝g^((c₁+c₂+…+c_m)^-1) Wherein g ═ e (P)₁,P_pub)；

Then d is_ADestroying P_A、g_c、c_iTo device number i, i 1, …, m (perhaps including itself).

For the second scheme, if the user's SM9 identifies the private key d_AWhile for data decryption, e (d) needs to be calculated during data decryption_AV) where V is a group G₂E (d) in the following manner_AV) cooperative calculation:

device number i calculates v_i＝e(P_A,V)^c_i，i＝2,…,m；

One device calculates v ═ v₁v₂…v_mThen v ═ e (d)_A,V)。

The second modification,

A variation of the second scheme for the SM9 digital signature collaborative generation method is as follows:

in the initialization phase, d is known in advance_AThe device (which may be one of the m devices or one device other than the m devices) is in [1, n-1 ]]Randomly selecting an integer c and m integers b in the interval₁,b₂,…,b_mAnd such that (b)₁+b₂+…+b_m) mod n is 1, calculate:

P_A＝[c^-1]d_A，g_c＝g^(c^-1) Wherein g ═ e (P)₁,P_pub)；

d_i＝[b_i]d_A，i＝1,…,m；

Then d is_A，c，b₁,…,b_mDestroying P_A、g_c、d_iTo device No. i, i 1, …, m (perhaps including itself);

when the user's SM9 identification private key d needs to be generated_AFor the digital signature of the message M, M devices, the i-th device calculate S as follows_i：

S_i＝[r_i]P_A+[-h]d_i，i＝1,…,m；

Other calculations and operations are unchanged, including the way of calculating the collaborative calculation w and calculating h and S is unchanged.

A threshold scheme,

On the basis of the second scheme, an SM9 digital signature threshold generation method can be obtained, wherein the SM9 digital signature threshold generation method comprises k devices, the k devices carry out the collaborative generation of digital signatures in a (m, k) threshold secret sharing mode, and k > m is more than or equal to 2;

in the initialization phase, d is known in advance_AIn [1, n-1 ] (one of the k devices or one device other than the k devices)]Randomly selecting an integer c in the interval, dividing c into k secret shares according to a threshold secret sharing mode, and calculating P_A＝[c^-1]d_A，g_c＝g^(c^-1) Wherein g ═ e (P)₁,P_pub) Then d is_ADestroying P_A、g_cAnd k threshold secret shares are distributed to k devices (possibly including themselves) respectively;

when a digital signature for a message M needs to be generated by using the SM9 identification private key of a user, M devices in the k devices form a combination, the M devices in the combination are respectively marked as devices No. 1 to No. M, and each device in the combination respectively calculates and obtains (derives) a secret share (namely c) required by a scheme II applying the SM9 digital signature collaborative generation method according to the current combination by using the threshold secret of each device in the combination and according to the current combination₁,…,c_m) Then, the M devices generate a digital signature for the message M by applying the aforementioned scheme two of the SM9 digital signature cooperation generation method.

(secret c used by device number i of m device combinations_iI-1.. m, is a secret calculated or derived by the device i according to its threshold secret share for c and the combination of m devices currently generating digital signatures, e.g., for sharir threshold secret sharing for c, if the m-1-time polynomial on modulo n is f (x), then the threshold secret for the device j of the k devices is y_j(j), j ═ 1,2, …, k; when the jth device is digitally signed in combination with the other m-1 devices, the secret corresponding to the jth device is (a)_jy_j) mod n, where a_jIs a parameter calculated from m device combinations, c if the j device of the k devices is the i device of the m device combinations for generating digital signatures_i＝(a_jy_j)mod n)。

On the basis that the SM9 digital signature collaborative generation method includes the variant of the scheme one, the scheme two and the scheme two, an SM9 digital signature collaborative generation system can be constructed, which includes m devices that generate digital signatures for messages according to the SM9 digital signature collaborative generation method.

On the basis of the SM9 digital signature threshold generation method, an SM9 digital signature threshold generation system can be constructed, the system comprises k devices, k is larger than m and is larger than or equal to 2, and the k devices generate digital signatures aiming at the messages according to the SM9 digital signature threshold generation method.

From the above description it can be seen that by the method of the invention the user identification private key d is used when required_AWhen the message is digitally signed, the m devices can cooperatively generate the digital signature aiming at the message, and the method also supports the threshold generation of the digital signature, namely, the m devices in the k devices generate the digital signature aiming at the message through threshold secret sharing (threshold cryptographic operation).

Drawings

None.

Detailed Description

The present invention will be further described with reference to the following examples. The following examples are merely illustrative of a few possible embodiments of the present invention and are not intended to represent all possible embodiments and are not intended to limit the present invention.

Examples 1,

This embodiment includes m devices numbered 1 to m respectively, one of the m devices or one device other than the m devices knowing d in advance_AIn the initialization phase, m devices obtain the secret c by₁,…,c_mAnd calculating to obtain P_A、g_c：

Knowing d beforehand_AIn [1, n-1 ]]Randomly selecting m integers c in interval₁,…,c_mAnd calculating:

P_A＝[(c₁c₂…c_m)^-1]d_A，g_c＝g^((c₁c₂…c_m)^-1) Wherein g ═ e (P)₁,P_pub)；

Then d is_ADestroying P_A、g_c、c_iTo device No. i, i 1, …, m (perhaps including itself);

thereafter, when it is desired to identify the private key d using the user's SM9_AWhen the message is digitally signed, the m devices generate the digital signature for the message according to the first scheme of the SM9 digital signature cooperation generation method.

Examples 2,

This embodiment includes m devices numbered 1 to m, respectively, where device number 1 knows d in advance_AThat is, in the initialization phase, m devices obtain the secret c as follows₁,…,c_mAnd calculating to obtain P_A、g_c：

Device No. 1 is in [1, n-1 ]]Randomly selecting an integer c in the interval₁Calculating Q₁＝[(c₁)^-1]d_A，u₁＝g^((c₁)^-1) Wherein g ═ e (P)₁,P_pub) Then Q is added₁、u₁Sending the data to the next device, namely the No. 2 device;

device i receives Q_i-1、u_i-1After, i is 2…, m, at [1, n-1 ]]Randomly selecting an integer c in the interval_iCalculating Q_i＝[(c_i)^-1]Q_i-1，u_i＝u_i-1^((c_i)^-1)；

If i is m, then P is taken_A＝Q_m，g_c＝u_mOtherwise, the device No. i will send to the next device, i +1, until Q is completed_m、u_mCalculating;

device No. m will P_A、g_cTo other m-1 devices, device No. 1 distributes d_ADestroying;

thereafter, when it is desired to identify the private key d using the user's SM9_AWhen the message is digitally signed, the m devices generate the digital signature for the message according to the first scheme of the SM9 digital signature cooperation generation method.

Examples 3,

This embodiment includes m devices numbered 1 to m, respectively, where device number 1 is a user device and device number 1 is the pre-user's SM9 identifying the private key d_AThe remaining m-1 devices are cryptographic servers providing cryptographic services, and in the initialization phase, the m devices obtain the secret c as follows₁,…,c_mAnd calculating to obtain P_A、g_c：

Device No. 1 is in [1, n-1 ]]Randomly selecting an integer c in the interval₁Calculating Q₁＝[(c₁)^-1]d_A，u₁＝g^((c₁)^-1) Wherein g ═ e (P)₁,P_pub) Then Q is added₁、u₁Sending the data to the next device, namely the No. 2 device;

device i receives Q_i-1、u_i-1Then i is 2, …, m is [1, n-1 ]]Fixedly selecting an integer c unknown to other devices in the interval_i(i.e. for different d)_AFixed selection c_iValue of) calculating Q_i＝[(c_i)^-1]Q_i-1，u_i＝u_i-1^((c_i)^-1)；

If iIf m, then P is taken_A＝Q_m，g_c＝u_mOtherwise, the device No. i will send to the next device, i +1, until Q is completed_m、u_mCalculating;

device No. m will P_A、g_cDistributed to m devices, device No. 1 distributes d_ADestroying;

thereafter, when it is desired to identify the private key d using the user's SM9_AWhen the message is digitally signed, the m devices generate the digital signature for the message according to the first scheme of the SM9 digital signature cooperation generation method.

Examples 4,

This embodiment includes m devices numbered 1 to m respectively, one of the m devices or one device other than the m devices knowing d in advance_AIn the initialization phase, m devices obtain the secret c by₁,…,c_mAnd calculating to obtain P_A、g_c：

Knowing d beforehand_AIn [1, n-1 ]]Randomly selecting m integers c in interval₁,…,c_mAnd so that (c)₁+c₂+…+c_m) mod n ≠ 0, calculates:

P_A＝[(c₁+c₂+…+c_m)^-1]d_A，g_c＝g^((c₁+c₂+…+c_m)^-1) Wherein g ═ e (P)₁,P_pub)；

Then d is_ADestroying P_A、g_c、c_iTo device No. i, i 1, …, m (perhaps including itself);

thereafter, when it is desired to identify the private key d using the user's SM9_AWhen digitally signing a message, the m devices generate a digital signature for the message according to the scheme two of the SM9 digital signature collaborative generation method.

Examples 5,

This embodiment includes m devices numbered 1 to m respectively, one of the m devices or one device other than the m devices being provided in advanceKnowing d_A；

In the initialization phase, d is known in advance_AThe device (which may be one of the m devices or one device other than the m devices) is in [1, n-1 ]]Randomly selecting an integer c and m integers b in the interval₁,…,b_mAnd such that (b)₁+b₂+…+b_m) mod n is 1, calculate:

P_A＝[c^-1]d_A，g_c＝g^(c^-1) Wherein g ═ e (P)₁,P_pub)；

d_i＝[b_i]d_A，i＝1,…,m；

Then d is_A，c，b₁,…,b_mDestroying P_A、g_c、d_iTo device No. i, i 1, …, m (perhaps including itself);

thereafter, when it is desired to identify the private key d using the user's SM9_AWhen digitally signing a message, the m devices generate a digital signature for the message according to the variant of the second scheme of the SM9 digital signature cooperation generation method.

Examples 6,

This embodiment includes k devices, one or more of which knows in advance the user's SM9 identification private key d_AThe k devices adopt a (m, k) threshold secret sharing mode to carry out the cooperative generation of the digital signature, k>m is more than or equal to 2; knowing d beforehand in the initialization phase_AThe device shares a secret among k devices according to a threshold secret sharing scheme, and calculates P_A、g_c：

Knowing d beforehand_AIn [1, n-1 ]]Randomly selecting an integer c in the interval, and then dividing the c into k secret shares according to a threshold secret sharing mode; calculating P_A＝[c^-1]d_A，g_c＝g^(c^-1) Wherein g ═ e (P)₁,P_pub) (ii) a Then d is_ADestroying P_A、g_cAnd k threshold secret shares are respectively distributed to k devices;

when a digital signature for the message M needs to be generated by using the SM9 identification private key of the user, M devices in the k devices form a combination, and the digital signature for the message is generated by adopting the SM9 digital signature threshold generation method.

The method according to the invention can construct a corresponding SM9 digital signature collaborative generation system.

If the scheme of threshold secret sharing is not adopted, the system comprises m devices, wherein m is greater than or equal to 2, the m devices are all cryptographic servers providing cryptographic services, or one device of the m devices is a user device, and the rest m-1 devices are cryptographic servers providing cryptographic services, when digital signature is required to be carried out on a message by using the SM9 identification private key of the user, the m devices cooperatively generate a digital signature for the message by implementing the SM9 digital signature cooperative generation method of the invention according to the scheme I or the scheme II or the variant of the scheme II, including implementing the foregoing embodiments 1-5, and cooperatively generate the digital signature for the message by using the SM9 identification private key of the user.

If the scheme of (m, k) threshold secret sharing is adopted, and k > m is greater than or equal to 2, the system comprises k devices, wherein the k devices are all cryptographic servers providing cryptographic services, or one device of the k devices is a user device, and the rest k-1 devices are cryptographic servers providing cryptographic services, when digital signature is required to be carried out on a message by using the SM9 identification private key of the user, the m devices in the k devices utilize the threshold secret sharing share, and the SM9 digital signature threshold generation method of the invention is implemented, and comprises the implementation of the foregoing embodiment 6, and the SM9 identification private key of the user is cooperatively generated to be used for carrying out digital signature on the message.

Other specific technical implementations not described are well known to those skilled in the relevant art and will be apparent to those skilled in the relevant art.

Claims (10)

1. An SM9 digital signature collaborative generation method is characterized in that:

the process involves m devices, where m.gtoreq.2;

the m devices are respectively numbered from No. 1 to No. m;

m devices respectively store [1, n-1 ]]Integer secret c within interval₁,c₂,…,c_mWhere n is group G in the SM9 cryptographic algorithm₁、G₂、G_TStep (c) of_iIs a secret held by device number i, i-1, …, m;

pre-calculated in the initialization phase to obtain:

P_A＝[(c₁c₂…c_m)^-1]d_A，

g_c＝g^((c₁c₂…c_m)^-1)，

wherein d is_AIs the identity ID of the user_AThe corresponding SM9 identifies the private key, (c)₁c₂…c_m)^-1Is (c)₁c₂…c_m) Modulo n multiplication inverse of (g ═ e) (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs a master public key;

when it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices generate digital signatures as follows:

device No. 1 is in [1, n-1 ]]Randomly selecting an integer r in the interval₁Calculate g₁＝g_c^r₁Or g₁＝g_c^(c₁r₁)；

Device No. 1 will g₁To the next device, device No. 2;

the device No. i receives g_i-1Then i is 2, …, m is [1, n-1 ]]Randomly selecting an integer r in the interval_iCalculate g_i＝(g_i-1^c_i)(g_c^r_i) Or g_i＝(g_i-1(g_c^r_i))^c_i；

If i ═ m, go to calculation h, otherwise, device No. i will calculate g_iTransmitting to the next device, i +1 device, until m device finishes g_mCalculating (1);

device m takes w ═ g_m；

One of the m devices:

calculating H as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | w represents that w is converted into a string and then merged with the string of M, and n is group G in SM9 cryptographic algorithm₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not, and if w is equal to g ^ h, re-performing g₁,…,g_mUntil w is not equal to g ^ h;

thereafter, device No. 1 calculates S as follows₁：

If device number 1 has previously calculated g₁The formula adopted is g₁＝g_c^r₁And then:

S₁＝[r₁-c₁h]P_A；

if device number 1 has previously calculated g₁The formula adopted is g₁＝g_c^(c₁r₁) And then:

S₁＝[c₁r₁-c₁h]P_A；

device No. 1 will S₁Sending the data to the next device, namely the No. 2 device;

the device No. i receives S_i-1Then, i is 2, …, m, S is calculated as follows_i：

If the device I calculates g before_iThe formula adopted is g_i＝(g_i-1^c_i)(g_c^r_i) And then:

S_i＝[c_i]S_i-1+[r_i]P_A；

if the device I calculates g before_iThe formula adopted is g_i＝(g_i-1(g_c^r_i))^c_iAnd then:

S_i＝[c_i](S_i-1+[r_i]P_A)；

if i is m, then S is S_m(h, S) is the generated digital signature for the message M, otherwise, the device No. i sends S_iTransmitting to the next device, i +1 device, until m device finishes S_mAnd (4) calculating.

2. The SM9 digital signature collaborative generation method of claim 1, wherein:

in the initialization phase, m devices obtain a secret c₁,…,c_mAnd calculating to obtain P_A、g_cOne way of (2) is as follows:

knowing d beforehand_AIn [1, n-1 ]]Randomly selecting m integers c in interval₁,…,c_mAnd calculating:

P_A＝[(c₁c₂…c_m)^-1]d_A，g_c＝g^((c₁c₂…c_m)^-1) Wherein g ═ e (P)₁,P_pub)；

Then d is_ADestroying P_A、g_c、c_iTo device No. i, i 1, …, m.

3. The SM9 digital signature collaborative generation method of claim 1, wherein:

if d is_AIs known in advance by device No. 1, m devices obtain the secret c during the initialization phase₁,…,c_mAnd calculating to obtain P_A、g_cOne way of (2) is as follows:

device No. 1 is in [1, n-1 ]]Randomly selecting an integer c in the interval₁Or in [1, n-1 ]]Fixedly selecting an integer c unknown to other devices in the interval₁Calculating Q₁＝[(c₁)^-1]d_A，u₁＝g^((c₁)^-1) Wherein g ═ e (P)₁,P_pub) Then Q is added₁、u₁Sending the data to the next device, namely the No. 2 device;

device i receives Q_i-1、u_i-1Then i is 2, …, m is [1, n-1 ]]Randomly selecting an integer c in the interval_iOr in [1, n-1 ]]Fixedly selecting an integer c unknown to other devices in the interval_iCalculating Q_i＝[(c_i)^-1]Q_i-1，u_i＝u_i-1^((c_i)^-1)；

If i is m, then P is taken_A＝Q_m，g_c＝u_mOtherwise, the device No. i will send to the next device, i +1, until Q is completed_m、u_mCalculating;

finally, device number m will P_A、g_cTo other m-1 devices, device No. 1 distributes d_AAnd (4) destroying.

4. An SM9 digital signature cooperative generation system based on the SM9 digital signature cooperative generation method of any one of claims 1 to 3, characterized by:

the system comprises m devices, and the m devices generate digital signatures aiming at the messages according to the SM9 digital signature collaborative generation method.

5. An SM9 digital signature collaborative generation method is characterized in that:

the process involves m devices, where m.gtoreq.2;

the m devices are respectively numbered from No. 1 to No. m;

m devices each have [1, n-1 ] stored or derived from the stored secret]Integer secret c within interval₁,c₂,…,c_mWherein n is group G in SM9 cryptographic algorithm₁、G₂、G_TStep (c) of_iIs a secret held by or derived from device number i, i is 1, …, m, and (c)₁+c₂+…+c_m)mod n≠0；

Pre-calculated in the initialization phase to obtain:

P_A＝[(c₁+c₂+…+c_m)^-1]d_A，

g_c＝g^((c₁+c₂+…+c_m)^-1)，

wherein d is_AIs the identity ID of the user_AThe corresponding SM9 identifies the private key, (c)₁+c₂+…+c_m)^-1Is (c)₁+c₂+…+c_m) Modulo n multiplication inverse of (g ═ e) (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs a master public key;

when it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices generate digital signatures as follows:

device number i in [1, n-1 ]]Randomly selecting an integer r in the interval_iCalculate g_i＝g_c^r_i，i＝1,…,m；

One of the m devices:

calculating w ═ g₁g₂…g_m，h＝H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | w represents that w is converted into a string and then merged with the string of M, and n is group G in SM9 cryptographic algorithm₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not, and if w is equal to g ^ h, re-performing g₁,…,g_mUntil w is not equal to g ^ h;

thereafter, the i-th device calculates S_i＝[(r_i-c_ih)]P_A，i＝1,…,m；

Then, one of the m devices calculates S ═ S₁+S₂+…+S_m；

Then (h, S) is the generated digital signature for message M.

6. The SM9 digital signature collaborative generation method of claim 5, wherein:

in the initialization phase, m devices obtain a secret c₁,…,c_mAnd calculating to obtain P_A、g_cOne way of (2) is as follows:

knowing d beforehand_AIn [1, n-1 ]]Randomly selecting m integers c in interval₁,…,c_mAnd so that (c)₁+c₂+…+c_m) mod n ≠ 0, calculates:

P_A＝[(c₁+c₂+…+c_m)^-1]d_A，g_c＝g^((c₁+c₂+…+c_m)^-1) Wherein g ═ e (P)₁,P_pub)；

Then d is_ADestroying P_A、g_c、c_iTo device No. i, i 1, …, m.

7. The SM9 digital signature collaborative generation method of claim 5, wherein:

one variation on the SM9 digital signature collaborative generation method is as follows:

in the initialization phase, d is known in advance_AIn [1, n-1 ]]Randomly selecting an integer c and m integers b in the interval₁,b₂,…,b_mAnd such that (b)₁+b₂+…+b_m) mod n is 1, calculate:

P_A＝[c^-1]d_A，g_c＝g^(c^-1) Wherein g ═ e (P)₁,P_pub)；

d_i＝[b_i]d_A，i＝1,…,m；

Then d is_A，c，b₁,…,b_mDestroying P_A、g_c、d_iTo device No. i, i 1, …, m;

when the user's SM9 identification private key d needs to be generated_AFor the digital signature of the message M, M devices, the i-th device calculate S as follows_i：

S_i＝[r_i]P_A+[-h]d_i，i＝1,…,m；

Other calculations and operations are unchanged, including the way of calculating the collaborative calculation w and calculating h and S is unchanged.

8. An SM9 digital signature threshold generation method based on the SM9 digital signature cooperation generation method of claim 5, characterized by:

the SM9 digital signature threshold generation method comprises k devices, wherein the k devices carry out the collaborative generation of digital signatures in a (m, k) threshold secret sharing mode, and k > m is more than or equal to 2;

in the initialization phase, d is known in advance_AIn [1, n-1 ]]Randomly selecting an integer c in the interval, dividing c into k secret shares according to a threshold secret sharing mode, and calculating P_A＝[c^-1]d_A，g_c＝g^(c^-1) Wherein g ═ e (P)₁,P_pub) Then d is_ADestroying P_A、g_cAnd k threshold secret shares are respectively distributed to k devices;

when a digital signature for a message M needs to be generated by using an SM9 identification private key of a user, M devices in the k devices form a combination, the M devices in the combination are respectively marked as devices No. 1 to M, each device in the combination respectively calculates a secret share required by applying the SM9 digital signature collaborative generation method according to the current combination by using a threshold secret of the device, and then the M devices generate the digital signature for the message M by applying the SM9 digital signature collaborative generation method.

9. An SM9 digital signature cooperative generation system based on the SM9 digital signature cooperative generation method of any one of claims 5 to 7, characterized by:

the system comprises m devices, and the m devices generate digital signatures aiming at the messages according to the SM9 digital signature collaborative generation method.

10. An SM9 digital signature threshold generation system based on the SM9 digital signature threshold generation method of claim 8, characterized by:

the system comprises k devices, wherein k is larger than m and is larger than or equal to 2, and the k devices generate digital signatures aiming at the messages according to the SM9 digital signature threshold generation method.